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1 . (Previously Presented) A method of collecting network traffic data comprising: 
receiving a group of information; 

determining whether to process the group of information for network traffic data 
collection, wherein 

said determining is performed according to a sampling algorithm that is selected 
from one of 

a linear sampling algorithm, 
an exponential sampling algorithm, 
a natural log sampling algorithm, 
a burst sampling algorithm, and 

selecting the group of information based on an examination of traffic 
attribute data in the group of information; 
processing the group of information for network traffic data collection if the 

determination is to process the group of information; and 
forwarding the group of information to a destination. 

2. (Original) The method of Claim 1 wherein the group of information is an IP 

packet. 

3. (Canceled) 

4. (Original) The method of Claim 1 wherein forwarding the group of information 
to the destination comprises: 

identifying the destination using a forwarding table; 

if the destination is in the forwarding table, automatically forwarding the group of 

information to the destination; and 
otherwise sending the group of information to one or more processing engines to 

determine routing to the destination and forwarding the group of information 

according to the determined routing. 
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5. (Original) The method of Claim 1 wherein forwarding the group of information 
to the destination is performed after processing the group of information. 

6. (Previously Presented) The method of Claim 1 wherein the processing of the 
group of information for network traffic data collection comprises: 

determining if the group of information is part of one or more recorded traffic flows; 
creating a new entry in a table if the group of information is not part of the one or more 

recorded traffic flows; 
incrementing a field in an existing entry in the table if the group of information is part of 

the one or more recorded traffic flows; and 
time stamping the group of information. 

7. (Previously Presented) The method of Claim 6 wherein the processing of the 
group of information for network traffic data collection further comprises: 

creating a traffic information packet; and 

transmitting the traffic information packet to a network traffic data collection application. 

8. (Original) The method of Claim 7 wherein the traffic information packet 
comprises a header and one or more flow records. 

9. (Previously Presented) An apparatus for collecting network traffic data 
comprising: 

means for receiving a group of information; 

means for determining whether to process the group of information for network traffic 
data collection, wherein 

the means for determining comprises a means for sampling selected from one of 
a means for linear sampling, 
a means for exponential sampling, 
a means for natural log sampling, 
a means for burst sampling, and 
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a means for selecting the group of information based on an examination of 
traffic attribute data in the group of information; 
means for processing the group of information for network traffic data collection if the 

determination is to process the group of information; and 
means for forwarding the group of information to a destination. 

10. (Original) The apparatus of Claim 9 wherein the group of information is an IP 

packet. 

11. (Canceled) 

12. (Original) The apparatus of Claim 9 wherein the means for forwarding the group 
of information to the destination comprises: 

means for identifying the destination using a forwarding table; 

means for automatically forwarding the group of information to the destination if the 

destination is in the forwarding table; and 
means for sending the group of information to one or more processing engines to 

determine routing to the destination and then forward the group of information 

according to the determined routing otherwise. 

13. (Previously Presented) The apparatus of Claim 9 wherein the means for 
processing of the group of information for network traffic data collection comprises: 

means for determining if the group of information is part of one or more recorded traffic 
flows; 

means for creating a new entry in a table if the group of information is not part of the one 

or more recorded traffic flows; 
means for incrementing a field in an existing entry in the table if the group of information 

is part of the one or more recorded traffic flows; and 
means for time stamping the group of information. 
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14. (Previously Presented) The apparatus of Claim 13 herein the means for 
processing of the group of information for network traffic data collection further comprises: 

means for creating a traffic information packet; and 

means for transmitting the traffic information packet to a network traffic data collection 
application. 

15. (Original) The apparatus of Claim 14 wherein the traffic information packet 
comprises a header and one or more flow records. 

16. (Previously Presented) A network node for collecting network traffic data having 
one or more processing engines and a memory comprising a set of instructions to: 

receive a group of information; 

determine whether to process the group of information for network traffic data collection, 
wherein 

the set of instructions to determine comprises a sampling algorithm that is 
selected from one of 
a linear sampling algorithm, 
an exponential sampling algorithm, 
a natural log sampling algorithm, 
a burst sampling algorithm, and 

selecting the group of information based on an examination of traffic 
attribute data in the group of information; 
process the group of information for network traffic data collection if the determination is 

to process the group of information; and 
forward the group of information to the destination. 

17. (Original) The network node of Claim 16 wherein the group of information is an 
IP packet. 

18. (Canceled) 
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19. (Original) The network node of Claim 16 wherein the set of instructions to 
forward the group of information to the destination comprises a set of instructions to: 

identify the destination using a forwarding table; 

if the destination is in the forwarding table, automatically forward the group of 

information to the destination; and 
otherwise send the group of information to one or more processing engines to determine 

routing to the destination and forward the group of information according to the 

determined routing. 

20. (Previously Presented) The network node of Claim 16 wherein the set of 
instructions to process the group of information for network traffic data collection comprises a 
set of instructions to: 

determine if the group of information is part of one or more recorded traffic flows; 
create a new entry in a table if the group of information is not part of the one or more 

recorded traffic flows; 
increment a field in an existing entry in the table if the group of information is part of the 

one or more recorded traffic flows; and 
time stamp the group of information. 

21 . (Previously Presented) The network node of Claim 20 wherein the set of 
instructions to process the group of information for network data collection further comprises a 
set of instructions to: 

create a traffic information packet; and 

transmit the traffic information packet to a network traffic data collection application. 

22. (Original) The network node of Claim 21 wherein the traffic information packet 
comprises a header and one or more flow records. 

23. (Previously Presented) A router comprising: 
one or more switch fabrics; 

one or more destination line cards coupled to the one or more switch fabrics; 
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a source line card coupled to one of the one or more switch fabrics, wherein 

the source line card receives a data packet; 
a router processor, coupled to the switch fabric, and configured to 

determine whether to process the data packet for network traffic data collection 

according to a sample algorithm; 
process the data packet for network traffic data collection if the determination is 

to process the data packet; and 
forwards the data packet to one of the one or more destination line cards. 

24. (Previously Presented) The apparatus of Claim 23 wherein the data packet is an 
IP packet. 

25. (Previously Presented) The apparatus of Claim 23 wherein the sample algorithm 
is selected from one of a linear sampling algorithm, an exponential sampling algorithm, a natural 
log sampling algorithm, a burst sampling algorithm, and selecting the data packet based on an 
examination of traffic attribute data in the data packet. 

26. (Previously Presented) The apparatus of Claim 23 wherein to forward the data 
packet to one of the one or more destination line cards, the source line card: 

identifies the one of the one or more destination line cards using a forwarding table; 
if the one of the one or more destination line cards is in the forwarding table, 

automatically forwards the data packet to the one of the one or more destination 

line cards; and 

otherwise sends the data packet to the router processors to determine routing to one of the 
one or more destination line cards and then forwards the data packet according to 
the determined routing. 

27. (Previously Presented) The apparatus of Claim 26 wherein the router processor is 
located on the source line card. 

28. (Previously Presented) The apparatus of Claim 23 wherein to process the data 
packet for network traffic data collection, the source line card: 
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determines if the data packet is part of one or more recorded traffic flows; 
creates a new entry in a table if the data packet is not part of the one or more recorded 
traffic flows; 

increments a field in an existing entry in the table if the data packet is part of the one or 

more recorded traffic flows; and 
time stamps the data packet. 

29. (Previously Presented) The apparatus of Claim 28 wherein to process the data 
packet for network traffic data collection, the source line card further: 

creates a traffic information packet; and 

transmits the traffic information packet to a network traffic data collection application. 

30. (Original) The apparatus of Claim 29 wherein the traffic information packet 
comprises a header and one or more flow records. 
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